CVE-2020-1180Out-of-bounds Write in Microsoft Chakracore

Severity
7.5HIGHNVD
CNA4.2GHSA8.1GHSA4.2OSV8.1
EPSS
1.7%
top 17.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 11
Latest updateAug 2

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take c

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages3 packages

CVEListV5microsoft/chakracore< publication
NVDmicrosoft/chakracore< 1.11.22
CVEListV5microsoft/microsoft_edge1.0..0publication

Patches

🔴Vulnerability Details

5
GHSA
Remote code execution in ChakraCore2021-08-02
OSV
Remote code execution in ChakraCore2021-08-02
GHSA
Remote code execution in ChakraCore2021-08-02
GHSA
Remote code execution in ChakraCore2021-08-02
CVEList
Scripting Engine Memory Corruption Vulnerability2020-09-11

📋Vendor Advisories

1
Microsoft
Scripting Engine Memory Corruption Vulnerability2020-09-08

💬Community

35
Bugzilla
CVE-2019-16711 ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps2.c2020-02-11
Bugzilla
CVE-2019-16712 ImageMagick: memory leak in Huffman2DEncodeImage in coders/ps3.c2020-02-11
Bugzilla
CVE-2019-19948 ImageMagick: heap-based buffer overflow in WriteSGIImage in coders/sgi.c2020-01-20
Bugzilla
CVE-2019-14981 ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c2019-10-02
Bugzilla
CVE-2019-12979 imagemagick: use of uninitialized value in functionSyncImageSettings in MagickCore/image.c2019-07-23
CVE-2020-1180 — Out-of-bounds Write in Microsoft | cvebase